npm 10-12 .npm-extension bypasses npm pack ignore-scripts

An analysis of npm versions 10 through 12 reveals that several features designed to prevent arbitrary code execution during package packing and installation—such as --ignore-scripts, .npm-extension, and allow-scripts—can be bypassed. The investigation demonstrates that local package packing still executes code through internal directory fetching, git dependencies execute prepare scripts before policies can block them, and specific git ref structures can trigger argument injection vulnerabilities during resolution regardless of security flags. Open article →